v0.60.0

Added

• Added a first tranche of private channels: audience-scoped recipient sets that
  deliver a chat only to a channel's online members instead of broadcasting it.
  synapse channel create/join/leave/list manages membership and
  synapse send --channel <id> (or SynapseAgent.chat(..., channel=<id>))
  routes to members only — a non-member sender is refused and a non-member never
  receives the body, which is also kept out of the public chat history and relay
  log. Join is open in this tranche (audience scoping, not a security boundary);
  per-channel history, retention, and channel-filtered queries remain design
  targets in docs/private-channels.
• Added a foundation tranche of at-rest encryption: an AES-256-GCM envelope with
  scrypt passphrase derivation, owner-only key files, and atomic encrypted-file
  helpers in synapse_channel.core.at_rest, plus synapse encrypt-key generate/check to manage key files. The AES-GCM primitive uses the optional
  cryptography dependency (pip install synapse-channel[encryption]); the
  package still imports without it. Storage-surface wiring (relay log, A2A state,
  archives) and live SQLite event-store encryption remain design targets in
  docs/at-rest-encryption.